[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.0.5 42/43] hw/net/vmxnet3: Fix guest-triggerable assert()
From: |
Michael Tokarev |
Subject: |
[Stable-8.0.5 42/43] hw/net/vmxnet3: Fix guest-triggerable assert() |
Date: |
Sat, 9 Sep 2023 16:00:08 +0300 |
From: Thomas Huth <thuth@redhat.com>
The assert() that checks for valid MTU sizes can be triggered by
the guest (e.g. with the reproducer code from the bug ticket
https://gitlab.com/qemu-project/qemu/-/issues/517 ). Let's avoid
this problem by simply logging the error and refusing to activate
the device instead.
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during
activate")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
[Mjt: change format specifier from %d to %u for uint32_t argument]
(cherry picked from commit 90a0778421acdf4ca903be64c8ed19378183c944)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index cb52db96a2..fd3b9aff5b 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1439,7 +1439,10 @@ static void vmxnet3_activate_device(VMXNET3State *s)
vmxnet3_setup_rx_filtering(s);
/* Cache fields from shared memory */
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
- assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
+ if (s->mtu < VMXNET3_MIN_MTU || s->mtu > VMXNET3_MAX_MTU) {
+ qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Bad MTU size: %u\n", s->mtu);
+ return;
+ }
VMW_CFPRN("MTU is %u", s->mtu);
s->max_rx_frags =
--
2.39.2
- [Stable-8.0.5 33/43] hw/ide/ahci: simplify and document PxCI handling, (continued)
- [Stable-8.0.5 33/43] hw/ide/ahci: simplify and document PxCI handling, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 34/43] hw/ide/ahci: PxSACT and PxCI is cleared when PxCMD.ST is cleared, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 36/43] hw/ide/ahci: fix ahci_write_fis_sdb(), Michael Tokarev, 2023/09/09
- [Stable-8.0.5 37/43] hw/ide/ahci: fix broken SError handling, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 35/43] hw/ide/ahci: PxCI should not get cleared when ERR_STAT is set, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 38/43] hw/i2c/aspeed: Fix Tx count and Rx size error in buffer pool mode, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 39/43] hw/i2c/aspeed: Fix TXBUF transmission start position error, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 40/43] qemu-options.hx: Rephrase the descriptions of the -hd* and -cdrom options, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 41/43] docs tests: Fix use of migrate_set_parameter, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 43/43] qxl: don't assert() if device isn't yet initialized, Michael Tokarev, 2023/09/09
- [Stable-8.0.5 42/43] hw/net/vmxnet3: Fix guest-triggerable assert(),
Michael Tokarev <=